Re: [TLS] Draft 18 review : Hello Retry Request and supported groups cache

[Eric Rescorla <[e-mail]>]

On Wed, Nov 23, 2016 at 5:25 AM, Olivier Levillain <
[e-mail]> wrote:

> >> There were actually two points in my message:
> >>  - I was not convinced by this way of signalling a preference without
> >> enforcing it, but I understand that, if we keep supported_groups, it
> >> does not cost much and the client can safely ignore the server sent
> >> extension;
> >>  - however, I found strange that the specification stated that the
> >> client could update its view when seeing this extension, but that it was
> >> not stated in the case of an HRR where updating its views of the
> >> servers' preference would clearly be useful for the future. I only
> >> proposed to add the same text "The client MAY update its view of the
> >> server's preference when receiving an HRR, to avoid the extra round trip
> >> in future encounters".
> >>
> > This is is unsafe, because the HRR is unauthenticated. We could update it
> > after the handshake completes, but I think this is obvious enough that it
> > doesn't
> > need to be stated.
>
> Unless I am mistaken, EncryptedExtensions is not authenticated either
> (even if it is sent in the same flight as the authentication messages),
> so updating the client cache can not be done immediately after
> interpreting the supported_groups extension.
>

That is intended to be covered by the following text:

   by the client.  Clients MUST NOT act upon any information found in
   "supported_groups" prior to successful completion of the handshake,
   but MAY use the information learned from a successfully completed
   handshake to change what groups they use in their "key_share"
   extension in subsequent connections.

My point about HRR is that the client can generally update its opinion
based on what it successfully completed the handshake with. This can
happen either with HRR or when it offered >1 shares and the server
took one. The special case is when supported_versions indicates a
key type you didn't use. So I think if we wanted text around this it would
go somewhere that covered the general case. I'm not sure it's needed
but if the WG feels like we should add some text, I can...

-Ekr


> However, if you believe this does not need to be stated, I am fine with
> that.
>
> olivier
>